Privacy Policy

Version 1.0 · Effective 2026-05-07

1. Who we are

Eddy ("we", "us", "our") is a reading and audio-alignment application. This Privacy Policy explains how we collect, use, and protect your personal information when you use our service. Our contact email for privacy matters is [privacy@eddy.example.com — update before launch].

2. Information we collect

Account information

When you register, we collect your email address and a hashed password. We do not store your password in plain text.

Reading activity

We store your reading progress (which documents you have opened, your position within them, and accumulated reading time) so you can resume where you left off across devices.

Audio data (optional, opt-in only)

If you enable "Contribute read-along audio" in Settings, audio from your read-along sessions is captured and stored alongside the reference text. This data is used solely to improve speech-recognition models. You can withdraw this consent at any time by turning the setting off; existing recordings will be deleted within 30 days of opt-out.

Technical data

We collect standard server logs (IP address, browser type, timestamp) for security and debugging. Session tokens are stored in secure, HttpOnly cookies. We do not use third-party analytics or advertising trackers.

3. How we use your information

Authenticate you and maintain your session.
Save and restore your reading progress.
Improve automatic speech recognition (only with your explicit consent).
Detect and prevent fraud or abuse.
Comply with legal obligations.

We do not sell your personal data to third parties.

4. Data retention

We retain your account data for as long as your account is active. If you request account deletion, we will erase your personal data within 30 days, except where retention is required by law. Opt-in audio recordings are retained for up to 12 months or until you withdraw consent, whichever comes first.

5. Data sharing and storage location

Your data is stored on servers located in the United States. We do not transfer your data to third-party processors except as required to operate the service, such as hosting infrastructure, transactional email, or verification providers. Any such processors must be bound by data-processing agreements consistent with applicable law. For EEA and UK users, international transfers are protected by appropriate safeguards, such as Standard Contractual Clauses or UK-approved transfer terms where required.

6. Your rights

All users

Access: You may request a copy of the data we hold about you.
Correction: You may ask us to correct inaccurate data.
Deletion: You may request that we delete your account and associated data.
Portability: You may request your data in a machine-readable format.
Opt-out of audio contribution: Withdraw consent at any time in Settings → Data & Privacy.

EEA / UK users (GDPR / UK GDPR)

Where we process your data based on legitimate interests, you have the right to object. You also have the right to lodge a complaint with your national supervisory authority. Our lawful bases for processing are: contract performance (account and reading features), legitimate interests (security), and consent (audio contribution).

California residents (CCPA / CPRA)

California residents have the right to know what personal information is collected, the right to delete it, the right to correct it, and the right to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising. To exercise your rights, contact us at the address in Section 1.

7. Children's privacy (COPPA)

Eddy is intended for users of all ages, including children under 13 in the United States. Please read our Children's Privacy Notice for full details on how we comply with the Children's Online Privacy Protection Act (COPPA) and the UK Children's Code. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

8. Cookies and local storage

We use a single secure, HttpOnly session cookie for authentication. We use browser local storage only to persist your theme preference. We do not use advertising cookies or cross-site tracking.

9. Changes to this policy

If we make material changes, we will notify you by email and require re-acceptance within the app before you can continue using the service. The version number and effective date above will be updated.

10. Contact

Questions or requests: [privacy@eddy.example.com — update before launch].
Postal address: [Insert registered address before launch].